Group Signature with Deniability: How to Disavow a Signature

Abstract

Group signatures are a class of digital signatures with enhanced privacy. By using this type of signature, a user can sign a message on behalf of a specific group without revealing his identity, but in the case of a dispute, an authority can expose the identity of the signer. However, in some situations it is only required to know whether a specific user is the signer of a given signature. In this case, the use of a standard group signature may be problematic since the specified user might not be the signer of the given signature, and hence, the identity of the actual signer will be exposed.Inspired by this problem, we propose the notion of a deniable group signature, where, with respect to a signature and a user, the authority can issue a proof showing that the specified user is NOT the signer of the signature, without revealing the actual signer. We also describe a fairly practical construction by extending the Groth group signature scheme (ASIACRYPT 2007). In particular, a denial proof in our scheme consists of 96 group elements, which is about twice the size of a signature in the Groth scheme. The proposed scheme is provably secure under the same assumptions as those of the Groth scheme.

Lattice-based group signatures: Achieving full dynamicity (and deniability) with ease

“…Another interesting functionality of group signatures that we consider in this work is deniability, suggested by Ishida et al [22]. It allows the tracing authority to provide a digital evidence that a given group user did not generate a signature in question.…”

“…It allows the tracing authority to provide a digital evidence that a given group user did not generate a signature in question. In [22], Ishida et al discussed various situations in which such functionality helps to protect the privacy of users. For instance, suppose that the entrace/exit control of a building is implemented using a group signature scheme, and the police wants to check whether a suspect was in this building at the time of a crime.…”

“…In such situation, deniable group signatures make it possible to prove that the signer of a given signature is not the suspect, while still keeping the signer's identity secret. As shown by Ishida et al [22], the main technical challenge towards realizing the deniability functionality consists of constructing a zero-knowledge proof/argument that a given ciphertext does not decrypt to a particular message. Such a mechanism is non-trivial to real-ize in general, but Ishida et al [22] managed to achieve it from pairing-based assumptions.…”

“…As shown by Ishida et al [22], the main technical challenge towards realizing the deniability functionality consists of constructing a zero-knowledge proof/argument that a given ciphertext does not decrypt to a particular message. Such a mechanism is non-trivial to real-ize in general, but Ishida et al [22] managed to achieve it from pairing-based assumptions.…”

“…Besides, considering that the journey to partial dynamicity in previous works [27,28] was shown not easy, we ask ourselves an inspiring question: Can we achieve full dynamicity with ease? Furthermore, given that deniability is an attractive and non-trivial functionality [22], can we also realize it with ease in the context of lattice-based group signatures? At the end of the day, it is good to solve an open research question, but it would be even better and more exciting to do this in a simple way.…”